@molpha/sdk 0.2.0-dev-20261001125531 → 0.2.0-dev-20261005112114

package/README.md

@@ -23,10 +23,10 @@ At a high level:
 Consumer
   └─ subscribes (USDC) on Solana
   └─ derives sourceId = keccak256(canonical apiConfig)
-  └─ signs a RequestAuth bound to (programId, gateway, sourceId, signaturesRequired, timestamp)
+  └─ signs a RequestAuth bound to (programId, gateway, sourceId, signaturesRequired, authTimestamp)
 
 Gateway
-  └─ coordinates a signing round for (sourceId, signaturesRequired)
+  └─ assigns the round's timestamp (unix ms) from its own clock and coordinates a signing round
 
 Verifier nodes
   └─ fetch/recompute the API result independently
@@ -46,7 +46,7 @@ Every signed attestation commits to the same message across chains:
 ```text
 message = keccak256(
   keccak256("MOLPHA_MESSAGE_V1") || value || sourceId || u32be(registryVersion) ||
-  u8(signaturesRequired) || u64be(canonicalTimestamp) || signersBitmap
+  u8(signaturesRequired) || u64be(timestamp) || signersBitmap
 )
 ```
 
@@ -64,7 +64,7 @@ Runtime dependencies include `@solana/kit`, `@anchor-lang/core`, and `@noble/*`.
 
 | Import | Use |
 |---|---|
-| `@molpha/sdk` | Facade (`MolphaSDK`), `MolphaGateway`, `MolphaSolanaClient`, core hashing (`deriveSourceId`, `attestationMessageHash`, `hashRequestAuth`), EVM/Starknet helpers. Browser-safe; no `fs` in the main entry. |
+| `@molpha/sdk` | Facade (`MolphaSDK`), `MolphaGateway`, `MolphaSolanaClient`, core hashing (`deriveSourceId`, `attestationMessageHash`, `hashRequestAuth`, `timestampSeconds`), EVM/Starknet helpers. Browser-safe; no `fs` in the main entry. |
 | `@molpha/sdk/utils` | `walletFromKeypairFile`, `loadKeypair` — load a Solana CLI keypair as an Anchor `Wallet`. Node.js only. |
 
 The package is ESM with `"sideEffects": false`, so gateway-only or read-only apps can tree-shake unused paths.
@@ -149,11 +149,13 @@ Gateway request authorization binds the gateway's on-chain account, so the clien
 
 ```text
 requestAuthHash = keccak256(
-  "MOLPHA_REQAUTH_V1" || programId || gatewayPda || sourceId || u8(signaturesRequired) || u64le(timestamp)
+  "MOLPHA_REQAUTH_V1" || programId || gatewayPda || sourceId || u8(signaturesRequired) || u64le(authTimestamp)
 )
 gatewayPda = PDA(["molpha_gateway", gatewayAuthority], programId)
 ```
 
+`authTimestamp` is the caller's unix **seconds** at signing: a freshness stamp for the authorization only (the gateway rejects stamps outside its `request_auth.window_seconds`, 60 s by default). It is read from the SDK clock for every attempt, so a retry after a 409 signs a fresh one. It has nothing to do with the round's `timestamp`.
+
 Pass `gatewayAuthority` (the gateway's base58 signing pubkey) per endpoint to pin it. When omitted, the SDK calls `GET {url}/v1/info` once per endpoint and reads:
 
 ```json
@@ -162,6 +164,20 @@ Pass `gatewayAuthority` (the gateway's base58 signing pubkey) per endpoint to pi
 
 A `programId` that differs from the client's is rejected. Because the hash differs per gateway, the auth signature is recomputed for every endpoint actually tried during failover — with a browser wallet that means one signing prompt per endpoint tried. `/v1/info` is never contacted when no signer is configured (dev zero-signature path).
 
+### Round timestamp
+
+The request body carries `authSig` and `authTimestamp` but no round timestamp. The gateway assigns the
+round's `timestamp` from its own clock, in unix **milliseconds**, on a tick grid
+(`floor(now / tickMs) * tickMs`, one second by default), and the result carries it in
+`payload.timestamp`. Committee selection reads only the timestamp's one-second window, so
+nobody can pick a committee by picking a time.
+
+- The message the nodes sign is `keccak256(MOLPHA_MESSAGE_V1 || value || sourceId || u32be(registryVersion) || u8(quorum) || u64be(timestamp) || signersBitmap)`.
+- Chain clocks, epochs and `maxAge`/staleness are in **seconds**: compare with
+  `timestampSeconds(payload.timestamp)` (floored `ts / 1000`). `timestampAgeSeconds(ts, nowSeconds)` saturates at 0.
+- A round that was already reserved for this consumer, or dispatched to the nodes, cannot run again in the same tick (HTTP 409), so a retry waits for the next one (`tickMs`, default 1000: set it to the gateway's `round.tick_ms`).
+- Private API secrets are encrypted for every node of the registry (the committee is unknown until the gateway stamps the round); the gateway forwards only the selected nodes' envelopes. `verifyNodeKeys` therefore authenticates all of them.
+
 ## Wallet
 
 `wallet` is a single `MolphaWallet` used across both protocol surfaces:
@@ -169,7 +185,7 @@ A `programId` that differs from the client's is rejected. Because the hash diffe
 | Layer | What it signs |
 |---|---|
 | Solana client | Transactions such as `subscribe`, `extendSubscription`, `submitAttestation` |
-| Gateway client | `hashRequestAuth({ programId, gateway, sourceId, signaturesRequired, timestamp })` for authenticated gateway requests |
+| Gateway client | `hashRequestAuth({ programId, gateway, sourceId, signaturesRequired, authTimestamp })` for authenticated gateway requests |
 
 Gateway auth is resolved automatically when you use `MolphaSDK`:
 
@@ -182,7 +198,8 @@ Gateway auth is resolved automatically when you use `MolphaSDK`:
 explicit `signer`. Standalone `new MolphaGateway(...)` omits auth unless you pass
 a `defaultSigner` (third constructor arg) or per-call `signer`.
 
-The all-zero `authSig` path is for development only. Production jobs should authenticate gateway requests.
+The all-zero `authSig` path is for development only: a gateway rejects it with 401. Production jobs should authenticate gateway requests.
+
 
 ### Node.js utility
 
@@ -276,7 +293,7 @@ const result = await sdk.gateway.requestSignedData({
 
 The gateway round uses the current on-chain registry version. Selected verifier nodes independently fetch/recompute the result and sign only if the observed value matches the canonical result.
 
-The returned `Attestation` matches the cross-VM struct (`payload` + `signature`), plus gateway-only `value` (human-readable) and `fresh`. `payload` carries `sourceId`, the signed 32-byte `value`, `canonicalTimestamp`, `registryVersion`, and `signaturesRequired`; `signature` carries the aggregate Schnorr material and `signersBitmap`. `signaturesRequired` must be at least the protocol's `min_signers` (currently 3) or the chain rejects the submit.
+The returned `Attestation` matches the cross-VM struct (`payload` + `signature`), plus gateway-only `value` (human-readable) and `fresh`. `payload` carries `sourceId`, the signed 32-byte `value`, `timestamp`, `registryVersion`, and `signaturesRequired`; `signature` carries the aggregate Schnorr material and `signersBitmap`. `signaturesRequired` must be at least the protocol's `min_signers` (currently 3) or the chain rejects the submit.
 
 A gateway response is a coordination result, not proof of settlement or of on-chain verification. Consumers still decide freshness, source, quorum and replay policy.
 
@@ -302,7 +319,7 @@ const feedState = await sdk.solana.readFeed(result.payload.sourceId, signaturesR
 
 `FeedAccount.value` is the 32 signed bytes (`valueKind.value`) or their keccak preimage hash (`valueKind.hash`); `submitter` is the wallet that created the feed.
 
-The subscription read no longer exposes usage. The program dropped `used_rounds` / `prepaid_usdc` / `price` from `Subscription`; round quota is counted by the gateway's off-chain outbox, so `SubscriptionInfo` carries only `owner`, `planType`, `validUntil`, `maxRounds`, `delegateCount`, `maxDelegates`, `maxSigners`.
+The subscription read does not expose usage: the program stores no `used_rounds` / `prepaid_usdc` / `price`, and round quota is counted by the gateway's off-chain outbox. `SubscriptionInfo` carries only `owner`, `planType`, `validUntil`, `maxRounds`, `delegateCount`, `maxDelegates`, `maxSigners`.
 
 ### One-call request + submit
 
@@ -540,7 +557,7 @@ attestation:
     sourceId: `0x${string}`,       // bytes32
     registryVersion: number,       // uint32
     signaturesRequired: number,    // uint8
-    canonicalTimestamp: bigint,    // uint64
+    timestamp: bigint,    // uint64
   },
   signature: {
     signature: `0x${string}`,      // bytes32 (Attestation.signature.s)
@@ -692,7 +709,7 @@ attestation:
     source_id: u256,
     registry_version: u32,
     signatures_required: u8,
-    canonical_timestamp: u64,
+    timestamp: u64,
   },
   signature: {
     signature: u256,
@@ -742,7 +759,7 @@ shared with the EVM verifier contract and exported as `VERIFY_CODES`:
 | 0 | `OK` | Verified |
 | 2 | `BAD_REGISTRY_VERSION` | `registryVersion` does not exist on this verifier |
 | 3 | `MALFORMED` | Structurally invalid input, or dated in the future when `maxAge != 0` |
-| 4 | `NOT_YET_ACTIVE` | `canonicalTimestamp` predates the registry version's activation |
+| 4 | `NOT_YET_ACTIVE` | `timestamp` predates the registry version's activation |
 | 5 | `VERSION_EXPIRED` | Registry version superseded more than the grace window earlier |
 | 7 | `BAD_QUORUM` | Signers are not within the round's derived selection group |
 | 8 | `BAD_AGGREGATE` | The signers' aggregate key is the point at infinity |
@@ -770,7 +787,7 @@ A Molpha attestation is valid only if the verifier can confirm:
 - the update targets the expected `sourceId`;
 - the result was signed against a specific `registryVersion` (an immutable node-set snapshot);
 - the quorum satisfies `signaturesRequired`;
-- the signer bitmap is a subset of the deterministic selection for `(sourceId, registryVersion, canonicalTimestamp)`;
+- the signer bitmap is a subset of the deterministic selection for `(sourceId, registryVersion, timestamp)`;
 - the aggregate Schnorr signature over `attestationMessageHash(...)` is valid;
 - the timestamp is within the accepted freshness bounds;
 - on Solana, the signer `Node` accounts passed as remaining accounts are exactly `registry.nodes[bit]` for every set bit, and the supplied coalition key matches the sum of their keys.
@@ -834,7 +851,7 @@ Current scope:
 
 - Solana subscription and extend flow;
 - deterministic source id and attestation message hashing;
-- gateway signed-data requests (failover, retries, per-gateway request auth, context cache);
+- gateway signed-data requests (failover, tick-aware retries, per-gateway request auth, context cache);
 - Solana attestation submission and feed/registry reads;
 - private API encryption helpers (pre-production);
 - caller-funded x402 payments for paywalled API sources (Base USDC, pre-production);

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { Address } from '@solana/kit';
 import { Wallet, Idl, AnchorProvider } from '@anchor-lang/core';
-import { U as UpstreamQuote, A as APIConfig, a as AssetDomain, b as UpstreamTerms, E as EvmSigner, R as RegistrySelectionConfig, S as Signer, N as NodeKeyVerifier, c as Node, d as NodesInfo, e as SourcePaymentOptions, f as Attestation, g as SolanaAccountMeta, h as SolanaConnection, i as SolanaAddress, j as NodeKeyVerifierArgs, k as AggregationConfig, M as MolphaWallet } from './wallet-HfGXPpOp.js';
-export { l as AttestationPayload, m as EncKeyBundle, n as NumericConfig, o as RegistryInfo, p as SchnorrSignature, q as gatewaySignerFromWallet, s as signerFromKeypair } from './wallet-HfGXPpOp.js';
+import { U as UpstreamQuote, A as APIConfig, a as AssetDomain, b as UpstreamTerms, E as EvmSigner, R as RegistrySelectionConfig, S as Signer, N as NodeKeyVerifier, c as Node, d as NodesInfo, e as SourcePaymentOptions, f as Attestation, g as SolanaAccountMeta, h as SolanaConnection, i as SolanaAddress, j as NodeKeyVerifierArgs, k as AggregationConfig, M as MolphaWallet } from './wallet-LqCFWwV4.js';
+export { l as AttestationPayload, m as EncKeyBundle, n as NumericConfig, o as RegistryInfo, p as SchnorrSignature, q as gatewaySignerFromWallet, s as signerFromKeypair } from './wallet-LqCFWwV4.js';
 import BN from 'bn.js';
 
 /**
@@ -48,8 +48,8 @@ interface RequestAuthFields {
     sourceId: Uint8Array | string;
     /** u8 — the per-request quorum. */
     signaturesRequired: number;
-    /** u64 unix seconds. */
-    timestamp: number | bigint;
+    /** u64 unix SECONDS at signing (the auth freshness stamp, not the round's timestamp). */
+    authTimestamp: number | bigint;
 }
 /** Borsh encoding of `RequestAuth` — the hash body, without the domain. */
 declare function encodeRequestAuth(fields: RequestAuthFields): Uint8Array;
@@ -117,15 +117,16 @@ interface RequestSignedDataOptions {
      */
     subscriptionOwner?: string;
     /**
-     * Solana pubkey (base58) of the consumer authority that signs gateway auth.
+     * Solana pubkey (base58) of the consumer: the subscription owner, or a delegate of it.
      * Overrides the gateway's `defaultConsumerAuthority` when set.
      */
     consumerAuthority?: string;
     /**
-     * Signs `hashRequestAuth({ programId, gateway, sourceId, signaturesRequired, timestamp })`.
+     * Signs `hashRequestAuth({ programId, gateway, sourceId, signaturesRequired, authTimestamp })`.
      * The hash binds the gateway's on-chain account, so it is computed — and the signer
-     * invoked — once per endpoint actually tried. Overrides the gateway's `defaultSigner`
-     * when set. When both are omitted, sends an all-zero authSig (dev only).
+     * invoked — once per endpoint actually tried, with a fresh `authTimestamp` each time.
+     * Overrides the gateway's `defaultSigner` when set. When both are omitted, sends an all-zero
+     * authSig (a gateway rejects it with 401; for tests and local tooling only).
      */
     signer?: Signer;
     encrypt?: {
@@ -144,8 +145,13 @@ interface RequestSignedDataOptions {
     sourcePayment?: SourcePaymentOptions;
     /** Max accepted value age in seconds. Default 60. */
     maxAge?: number;
-    /** Each retry re-rolls the timestamp. Default 15. */
+    /** Max attempts; each retry waits for a later gateway tick. Default 15. */
     maxRetries?: number;
+    /**
+     * The gateway's tick grid in milliseconds (its `round.tick_ms`). A retry waits for the start of
+     * the next tick so it is a new round, not a duplicate of the last. Default 1000.
+     */
+    tickMs?: number;
     /** Per-request timeout in ms. Default 5000. */
     timeoutMs?: number;
     /**
@@ -177,8 +183,9 @@ interface MolphaGatewayOptions {
     /** Solana pubkey (base58) of the consumer authority used when a request omits it. */
     defaultConsumerAuthority?: string;
     /**
-     * Molpha program id the request authorization is bound to. Defaults to the vendored
-     * `MOLPHA_PROGRAM_ID`; must match the gateway's deployment.
+     * Molpha program id the request authorization is bound to (and that `fetchGatewayInfo`
+     * checks the gateway settles against). Defaults to the vendored `MOLPHA_PROGRAM_ID`;
+     * must match the gateway's deployment.
      */
     programId?: string;
     /**
@@ -197,9 +204,11 @@ interface MolphaGatewayOptions {
  * {@link MolphaGateway.prepareContext} and reuse across many rounds.
  */
 interface RoundContext extends RegistrySelectionConfig {
-    /** Full node set used to encrypt private API secrets for the selected nodes. */
+    /** Full registry node set: private API secrets are encrypted for every node in it. */
     nodes: Node[];
 }
+/** Milliseconds from `nowMs` to the start of the next tick, plus a millisecond of margin. */
+declare function msUntilNextTick(nowMs: number, tickMs: number): number;
 /** Default gateway base URL when `endpoints` is omitted. */
 declare const DEFAULT_GATEWAY_ENDPOINT = "https://dev-gateway.molpha.io/";
 /** Thrown for terminal gateway errors (400/401) — never retried. */
@@ -222,8 +231,8 @@ declare class MolphaGateway {
     private readonly gatewayPdas;
     constructor(endpoints?: GatewayEndpointInput | GatewayEndpointInput[], getRegistrySelectionConfig?: () => Promise<RegistrySelectionConfig>, defaultSigner?: Signer, 
     /**
-     * Either a default subscription owner (base58) or gateway options. A string
-     * keeps the previous positional form used by standalone callers/tests.
+     * Either a default subscription owner (base58) or gateway options. A string is the
+     * shorthand for `{ defaultSubscriptionOwner }` used by standalone callers/tests.
      */
     defaultSubscriptionOwnerOrOptions?: string | MolphaGatewayOptions, defaultConsumerAuthority?: string);
     /** Tries endpoints in order; returns the first node list it can fetch. */
@@ -233,7 +242,7 @@ declare class MolphaGateway {
      * selection policy, which sizes the eligible set a paid source must fund.
      *
      * The `registry` block is advisory: it is whatever the gateway read from the
-     * chain, and is absent on older gateways or when that read failed. Prefer the
+     * chain, and is absent when that read failed. Prefer the
      * on-chain read (`MolphaSolanaClient.getRegistrySelectionConfig`) whenever a
      * Solana connection is available — `requestSignedData` already does.
      */
@@ -257,12 +266,23 @@ declare class MolphaGateway {
     prepareContext(): Promise<RoundContext>;
     /**
      * Request a threshold-signed data update from the gateway, with retry +
-     * failover. Per attempt a fresh timestamp yields a fresh selection bitmap; the
-     * body is POSTed to each endpoint in order until one `completed`s.
+     * failover. The body is POSTed to each endpoint in order until one `completed`s.
+     *
+     * The round's `sourceId` is derived from `apiConfig`. The request carries no round timestamp:
+     * the gateway assigns the round's `timestamp` (unix milliseconds) from its own clock
+     * on a tick grid, and the committee follows from it. The result carries the assigned
+     * timestamp and the signers' bitmap. A retry waits for a later tick, because a round that was
+     * already reserved or dispatched cannot run again in the same one (HTTP 409).
      *
-     * The round's `sourceId` is derived from `apiConfig`. The request authorization
-     * binds the program id and each gateway's on-chain account, so the auth signature
-     * is recomputed for every endpoint tried.
+     * The request is authorized by a `RequestAuth` signature (`authSig`) over the program id, the
+     * endpoint's Gateway PDA, the source id, the quorum and `authTimestamp` (unix seconds, read
+     * from the local clock for every attempt). It only proves the caller may spend the
+     * subscription's rounds; it is not part of the round, so the signature is recomputed for every
+     * endpoint tried.
+     *
+     * Because the committee is unknown until the gateway stamps the round, private API
+     * secrets are encrypted for **every** node of the registry; the gateway forwards only the
+     * selected nodes' envelopes.
      *
      * By default this fetches the registry selection config up front and the node
      * set only when the round needs it (private API encryption, or when the registry
@@ -392,8 +412,7 @@ interface PlanInfo {
     isActive: boolean;
 }
 /**
- * On-chain `Subscription`. The program no longer tracks usage: `used_rounds`,
- * `prepaid_usdc` and the locked `price` were removed (round quota is counted by the
+ * On-chain `Subscription`. The program does not track usage (round quota is counted by the
  * gateway's off-chain outbox), so there is no on-chain "rounds used" figure to read.
  */
 interface SubscriptionInfo {
@@ -428,8 +447,8 @@ interface FeedAccount {
         hash: Record<string, never>;
     };
     submitter: Address;
-    /** u64 unix seconds. */
-    canonicalTimestamp: BN;
+    /** u64 unix MILLISECONDS (the round's gateway-assigned timestamp). */
+    timestamp: BN;
     signaturesRequired: number;
     signersBitmap: number[];
     registryVersion: number;
@@ -443,7 +462,7 @@ interface SubmitAttestationArgs {
             sourceId: number[];
             registryVersion: number;
             signaturesRequired: number;
-            canonicalTimestamp: BN;
+            timestamp: BN;
         };
         signature: {
             aggSigS: number[];
@@ -709,8 +728,8 @@ interface AttestationMessageFields {
     signersBitmap: string | Uint8Array;
     /** 32-byte packed value (hex or bytes). */
     value: string | Uint8Array;
-    /** Unix seconds (u64). */
-    canonicalTimestamp: number | bigint;
+    /** Unix milliseconds (u64), assigned by the gateway. */
+    timestamp: number | bigint;
 }
 /** Compute the attestation message hash (32 bytes). */
 declare function attestationMessageHash(fields: AttestationMessageFields): Uint8Array;
@@ -726,9 +745,17 @@ declare function normalizeSecp256k1PublicKeyHex(publicKeyHex: string, label?: st
 declare function secp256k1PublicKeyFromCoordinates(x: Uint8Array, y: Uint8Array, label?: string): string;
 
 /**
- * `seed = keccak256(keccak256("MOLPHA_SELECTION_V1") || sourceId || be32(rv) || be64(ts))`.
+ * Width in milliseconds of the window selection reads from the timestamp. The timestamp
+ * is unix milliseconds; the seed uses `floor(timestamp / SELECTION_WINDOW_MS)`, so
+ * sub-second precision never changes the committee. Changing it is a consensus break and must
+ * bump the selection prefix.
  */
-declare function deriveSelectionSeed(sourceId: Uint8Array, registryVersion: number, canonicalTimestamp: number | bigint): Uint8Array;
+declare const SELECTION_WINDOW_MS = 1000n;
+/**
+ * `seed = keccak256(keccak256("MOLPHA_SELECTION_V1") || sourceId || be32(rv) || be64(ts / 1000))`,
+ * where `ts` is the timestamp in unix MILLISECONDS (its 1 s window index is hashed).
+ */
+declare function deriveSelectionSeed(sourceId: Uint8Array, registryVersion: number, timestamp: number | bigint): Uint8Array;
 /** `min(signaturesRequired + redundancyBuffer, nodeCount)`. */
 declare function effectiveSelectionSize(signaturesRequired: number, redundancyBuffer: number, nodeCount: number): number;
 /** Is bit `bit` set in the 32-byte big-endian `bitmap`? */
@@ -743,10 +770,24 @@ declare function selectedIndices(bitmap: Uint8Array, nodeCount: number): number[
 declare function deriveGroupBitmap(seed: Uint8Array, nodeCount: number, groupSize: number): Uint8Array;
 /**
  * Convenience orchestrator: derive the selection bitmap end-to-end.
- * `redundancy` defaults to 0; `ts` defaults to the current unix second.
+ * `redundancy` defaults to 0; `ts` is the timestamp in unix MILLISECONDS and defaults
+ * to now. The gateway assigns the real timestamp of a round, so this is for tests and tools.
  */
 declare function deriveSelectionBitmap(sourceId: Uint8Array, registryVersion: number, nodeCount: number, signaturesRequired: number, redundancy?: number, ts?: number | bigint): Uint8Array;
 
+/**
+ * `timestamp` is unix MILLISECONDS, assigned by the gateway. Chain clocks (Solana `Clock`,
+ * EVM `block.timestamp`), epoch windows and `maxAge`/staleness are measured in SECONDS, so
+ * anything that compares the two must go through {@link timestampSeconds}.
+ */
+/** `timestamp` (unix ms) as whole unix seconds, floored. */
+declare function timestampSeconds(timestamp: number | bigint): number;
+/**
+ * Age in whole seconds of a timestamp against `nowSeconds`, saturating at 0 so a
+ * timestamp slightly ahead of the local clock never goes negative.
+ */
+declare function timestampAgeSeconds(timestamp: number | bigint, nowSeconds: number): number;
+
 /**
  * Result codes returned by Molpha's stateless verifier contracts (`verify` on EVM and
  * Starknet). Shared across VMs: the same attestation yields the same code on every chain.
@@ -761,11 +802,11 @@ declare const VERIFY_CODES: {
     readonly FEED_WITNESS: 1;
     /** The payload's `registryVersion` does not exist on this verifier. */
     readonly BAD_REGISTRY_VERSION: 2;
-    /** Structurally invalid input, or a `canonicalTimestamp` in the future when `maxAge != 0`. */
+    /** Structurally invalid input, or a `timestamp` in the future when `maxAge != 0`. */
     readonly MALFORMED: 3;
-    /** `canonicalTimestamp` predates the registry version's activation. */
+    /** `timestamp` predates the registry version's activation. */
     readonly NOT_YET_ACTIVE: 4;
-    /** The registry version was superseded more than the grace window before `canonicalTimestamp`. */
+    /** The registry version was superseded more than the grace window before `timestamp`. */
     readonly VERSION_EXPIRED: 5;
     /** Reserved. Never returned. */
     readonly COMPROMISED_QUORUM: 6;
@@ -823,7 +864,7 @@ declare const MOLPHA_VERIFIER_ABI: readonly [{
                 readonly type: "uint8";
                 readonly internalType: "uint8";
             }, {
-                readonly name: "canonicalTimestamp";
+                readonly name: "timestamp";
                 readonly type: "uint64";
                 readonly internalType: "uint64";
             }];
@@ -1071,8 +1112,8 @@ interface EvmAttestationPayload {
     registryVersion: number;
     /** `uint8`. */
     signaturesRequired: number;
-    /** `uint64`, unix seconds. */
-    canonicalTimestamp: bigint;
+    /** `uint64`, unix MILLISECONDS (`timestamp / 1000` is the seconds the verifier's `maxAge` uses). */
+    timestamp: bigint;
 }
 /** `IVerifier.SchnorrSignature`. */
 interface EvmSchnorrSignature {
@@ -1136,7 +1177,7 @@ declare function buildEvmVerifierArgs(attestation: Attestation, options: BuildEv
  * ABI calldata for `verify(attestation, maxAge)`: the 4-byte selector followed by nine
  * 32-byte words. Both structs are static, so they encode inline with no offsets:
  *
- * `value, sourceId, registryVersion, signaturesRequired, canonicalTimestamp, signature,
+ * `value, sourceId, registryVersion, signaturesRequired, timestamp, signature,
  *  commitment, signersBitmap, maxAge`
  *
  * For a raw `eth_call` (`{ to: verifier, data }`).
@@ -1182,8 +1223,8 @@ interface StarknetAttestationPayload {
     registry_version: number;
     /** `u8`. */
     signatures_required: number;
-    /** `u64`, unix seconds. */
-    canonical_timestamp: number;
+    /** `u64`, unix MILLISECONDS (`/ 1000` is the seconds the verifier's `max_age` uses). */
+    timestamp: number;
 }
 /** Starknet calldata shape for `SchnorrSignature`. */
 interface StarknetSchnorrSignature {
@@ -1243,7 +1284,7 @@ declare function buildStarknetVerifierArgs(attestation: Attestation, options: Bu
  * Flat felt calldata for `verify(attestation, max_age)`, in Cairo `Serde` order — 13 felts:
  *
  * `value.low, value.high, source_id.low, source_id.high, registry_version,
- *  signatures_required, canonical_timestamp, signature.low, signature.high, commitment,
+ *  signatures_required, timestamp, signature.low, signature.high, commitment,
  *  signers_bitmap.low, signers_bitmap.high, max_age`
  *
  * For a raw `starknet_call` with `entry_point_selector = selector("verify")`.
@@ -1342,4 +1383,4 @@ declare class MolphaSDK {
     }>;
 }
 
-export { APIConfig, AggregationConfig, AggregationConfigError, AssetDomain, Attestation, type AttestationMessageFields, type BuildEvmVerifierArgsOptions, type BuildStarknetVerifierArgsOptions, type CoalitionKey, DEFAULT_GATEWAY_ENDPOINT, EIP712_DOMAIN_TYPEHASH, type Eip712Domain, type EvmAttestation, type EvmAttestationPayload, type EvmSchnorrSignature, EvmSigner, type EvmVerifierArgs, type EvmVerifyResult, type FeedAccount, type GatewayEndpoint, type GatewayEndpointInput, GatewayError, type GatewayInfo, INT256_MAX, INT256_MIN, MESSAGE_PREFIX, MIN_TOLERANCE_SIGNATURES, MOLPHA_IDL, MOLPHA_PROGRAM_ADDRESS, MOLPHA_PROGRAM_ID, MOLPHA_VERIFIER_ABI, MOLPHA_VERIFIER_ADDRESS, MOLPHA_VERIFIER_STARKNET_ADDRESSES, MOLPHA_VERIFIER_STARKNET_SEPOLIA, type MolphaEvmNetwork, MolphaGateway, type MolphaGatewayOptions, MolphaSDK, type MolphaSDKOptions, MolphaSolanaClient, type MolphaStarknetNetwork, MolphaWallet, Node, NodeKeyVerifier, NodeKeyVerifierArgs, NodesInfo, type PlanId, type PlanInfo, PlanType, REQUEST_AUTH_DOMAIN, RegistrySelectionConfig, type RegistryStateView, type RegistryView, type RequestAuthFields, type RequestSignedDataOptions, type RoundContext, type Secp256k1KeyInput, Signer, SourcePaymentOptions, type StarknetAttestation, type StarknetAttestationPayload, type StarknetFeltLike, type StarknetSchnorrSignature, type StarknetVerifierArgs, type StarknetVerifyResult, type SubmitAttestationArgs, type SubmitAttestationOptions, type SubmitResult, type SubscribeResult, type SubscriptionInfo, TRANSFER_WITH_AUTHORIZATION_TYPEHASH, type TransferAuthorization, UpstreamPaymentRequiredError, UpstreamQuote, UpstreamTerms, VERIFY_CODES, type VerifyCode, type VerifyCodeName, addressToBytes, assertAggregationQuorum, attestationMessageHash, attestationMessageHashFromAttestation, base64ToBytes, bigIntFromBytesBe, bitmapBitSet, bitmapToIndices, buildEvmVerifierArgs, buildStarknetVerifierArgs, buildSubmitAttestationArgs, bytesToBase64, bytesToHex, bytesToHex0x, canonicalizeAPIConfig, canonicalizeAggregation, commitmentAddressToStarknetFelt, computeCoalitionKey, concatBytes, createEvmSignerFromPrivateKey, decodeInt256, deriveGatewayPda, deriveGatewayPdaAddress, deriveGroupBitmap, deriveSelectionBitmap, deriveSelectionSeed, deriveSourceId, deriveSourceIdString, domainSeparator, effectiveSelectionSize, eligibleSetSize, encodeEvmVerifyCalldata, encodeInt256, encodeInt256Decimal, encodeRequestAuth, encodeStarknetVerifyCalldata, ensureLength, evmAddressFromPrivateKey, feedPda, formatInt256Decimal, gatewayPda, getMolphaStarknetVerifierAddress, hashRequestAuth, hexToBytes, nodePda, normalizeEndpoint, normalizeSecp256k1PublicKeyHex, parseEvmVerifyResult, parseGatewayInfo, parseStarknetVerifyResult, parseUpstreamQuote, planIdFromVariant, planPda, planVariant, probeSource, protocolConfigPda, registryPda, registryStatePda, resolveRemainingAccounts, secp256k1PublicKeyFromCoordinates, selectedIndices, signSourcePayments, signersBitmapToDecimal, signersBitmapToStarknetUint256, signersBitmapToUint256, subscriptionPda, toChecksumAddress, toFixedBytes, toFixedHex, transferWithAuthorizationDigest, transferWithAuthorizationHash, u256beFromBigInt, u32be, u32le, u64be, u64le, u8, utf8, validateSuppliedTerms, verifyCodeName };
+export { APIConfig, AggregationConfig, AggregationConfigError, AssetDomain, Attestation, type AttestationMessageFields, type BuildEvmVerifierArgsOptions, type BuildStarknetVerifierArgsOptions, type CoalitionKey, DEFAULT_GATEWAY_ENDPOINT, EIP712_DOMAIN_TYPEHASH, type Eip712Domain, type EvmAttestation, type EvmAttestationPayload, type EvmSchnorrSignature, EvmSigner, type EvmVerifierArgs, type EvmVerifyResult, type FeedAccount, type GatewayEndpoint, type GatewayEndpointInput, GatewayError, type GatewayInfo, INT256_MAX, INT256_MIN, MESSAGE_PREFIX, MIN_TOLERANCE_SIGNATURES, MOLPHA_IDL, MOLPHA_PROGRAM_ADDRESS, MOLPHA_PROGRAM_ID, MOLPHA_VERIFIER_ABI, MOLPHA_VERIFIER_ADDRESS, MOLPHA_VERIFIER_STARKNET_ADDRESSES, MOLPHA_VERIFIER_STARKNET_SEPOLIA, type MolphaEvmNetwork, MolphaGateway, type MolphaGatewayOptions, MolphaSDK, type MolphaSDKOptions, MolphaSolanaClient, type MolphaStarknetNetwork, MolphaWallet, Node, NodeKeyVerifier, NodeKeyVerifierArgs, NodesInfo, type PlanId, type PlanInfo, PlanType, REQUEST_AUTH_DOMAIN, RegistrySelectionConfig, type RegistryStateView, type RegistryView, type RequestAuthFields, type RequestSignedDataOptions, type RoundContext, SELECTION_WINDOW_MS, type Secp256k1KeyInput, Signer, SourcePaymentOptions, type StarknetAttestation, type StarknetAttestationPayload, type StarknetFeltLike, type StarknetSchnorrSignature, type StarknetVerifierArgs, type StarknetVerifyResult, type SubmitAttestationArgs, type SubmitAttestationOptions, type SubmitResult, type SubscribeResult, type SubscriptionInfo, TRANSFER_WITH_AUTHORIZATION_TYPEHASH, type TransferAuthorization, UpstreamPaymentRequiredError, UpstreamQuote, UpstreamTerms, VERIFY_CODES, type VerifyCode, type VerifyCodeName, addressToBytes, assertAggregationQuorum, attestationMessageHash, attestationMessageHashFromAttestation, base64ToBytes, bigIntFromBytesBe, bitmapBitSet, bitmapToIndices, buildEvmVerifierArgs, buildStarknetVerifierArgs, buildSubmitAttestationArgs, bytesToBase64, bytesToHex, bytesToHex0x, canonicalizeAPIConfig, canonicalizeAggregation, commitmentAddressToStarknetFelt, computeCoalitionKey, concatBytes, createEvmSignerFromPrivateKey, decodeInt256, deriveGatewayPda, deriveGatewayPdaAddress, deriveGroupBitmap, deriveSelectionBitmap, deriveSelectionSeed, deriveSourceId, deriveSourceIdString, domainSeparator, effectiveSelectionSize, eligibleSetSize, encodeEvmVerifyCalldata, encodeInt256, encodeInt256Decimal, encodeRequestAuth, encodeStarknetVerifyCalldata, ensureLength, evmAddressFromPrivateKey, feedPda, formatInt256Decimal, gatewayPda, getMolphaStarknetVerifierAddress, hashRequestAuth, hexToBytes, msUntilNextTick, nodePda, normalizeEndpoint, normalizeSecp256k1PublicKeyHex, parseEvmVerifyResult, parseGatewayInfo, parseStarknetVerifyResult, parseUpstreamQuote, planIdFromVariant, planPda, planVariant, probeSource, protocolConfigPda, registryPda, registryStatePda, resolveRemainingAccounts, secp256k1PublicKeyFromCoordinates, selectedIndices, signSourcePayments, signersBitmapToDecimal, signersBitmapToStarknetUint256, signersBitmapToUint256, subscriptionPda, timestampAgeSeconds, timestampSeconds, toChecksumAddress, toFixedBytes, toFixedHex, transferWithAuthorizationDigest, transferWithAuthorizationHash, u256beFromBigInt, u32be, u32le, u64be, u64le, u8, utf8, validateSuppliedTerms, verifyCodeName };